{ "data": { "a": { "slug": "envia", "name": "Envia", "vendor": "Envia Shipping", "vendorUrl": "https://envia.com", "kind": "http-api", "category": "shipping", "summary": "Envia is a multi-carrier shipping platform, strongest in Latin America, with REST APIs for rates, labels, tracking, pickups, commercial invoices and address data. An official stdio MCP server exposes ten of those operations to agents.", "url": "https://www.anchorterminal.com/tools/envia", "markdownUrl": "https://www.anchorterminal.com/tools/envia.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/envia.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/envia.json", "dns": "envia.grade.anchorterminal.com", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@envia/envia-mcp" } ], "auth": "api-key", "authNotes": "Bearer API tokens created in the dashboard under `Desarrolladores \u003e Acceso de API`, one environment each: sandbox tokens work only against api-test.envia.com and production tokens only against api.envia.com. Several tokens can exist and each can be deleted to revoke it. No scopes were found. The MCP server reads the token from `ENVIA_API_KEY` and defaults to sandbox.", "pricing": "usage", "pricingNotes": "Prepaid balance: labels, notifications, insurance and add-ons draw on money added to the Envia account, and each price is shown when quoting. There is no public price list; volume plans go through sales. A free sandbox account returns simulated rates and creates test labels with no charges.", "priceSummary": "Pay per use", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the MCP package or the pricing page (checked 2026-11-06). Charges come from a prepaid balance.", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.envia.com/docs/getting-started", "llmsTxt": "https://docs.envia.com/llms.txt", "openapi": "https://docs.envia.com/reference/shipping-rates.md", "capabilities": [ "shipping.rates", "shipping.labels", "shipping.tracking", "shipping.address-validation" ], "tags": [ "official", "hosted", "mcp", "llms-txt", "openapi", "sandbox", "prepaid", "webhooks", "latam", "typescript" ], "lastRelease": "2026-03-06", "graded": true, "anchor": { "graded": true, "score": 36.5, "grade": "F", "agentReady": false, "rank": 1384, "ranked": true, "rankOf": 1510, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 53, "maintenance": 10, "payments": 20, "reliability": 20, "schema": 80, "security": 35, "transparency": 16 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-06" }, "negative": 0, "verdict": "Envia's shipping APIs are documented for agents, with llms.txt, OpenAPI definitions on every reference page, a free sandbox and a compact ten-tool MCP server that defaults to test mode. No status page, rate limits, public price list or readable terms were found, and the MCP package has had one release.", "bestFor": "Shops and platforms shipping in Mexico and Latin America that want rates and labels from many local carriers.", "strengths": [ "Free sandbox with simulated rates and test labels, kept apart from production by separate tokens", "OpenAPI definitions embedded in every reference page, plus llms.txt and Markdown docs", "Ten MCP tools that default to the sandbox environment", "Labels cancelled before the first carrier scan are refunded to the balance automatically", "Postal code and address-structure lookups work without a token" ], "weaknesses": [ "No status page or rate limits found", "No public price list; costs appear only when quoting", "Terms and privacy text could not be read, and no legal entity was found", "MCP tools carry no readOnly or destructive annotations, and the package has one release, 0.1.0", "The docs changelog stops at March 2026" ], "agentNotes": [ "Leave `ENVIA_ENVIRONMENT` unset until the user confirms live shipping; the default is sandbox", "Ask the user before `envia_create_label` in production, since it spends the account balance", "Validate the postal code at geocodes.envia.com before quoting to avoid no-coverage errors", "Cancel an unwanted label before the carrier scans it to get the automatic refund", "Use a sandbox token with sandbox hosts and a production token with production hosts; they are not interchangeable" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 36.5 } ], "editorialScores": { "ergonomics": 53, "maintenance": 10, "payments": 20, "reliability": 20, "schema": 80, "security": 35, "transparency": 0 }, "provenanceScore": 32, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @envia/envia-mcp@latest", "config": { "mcpServers": { "envia": { "args": [ "-y", "@envia/envia-mcp@latest" ], "command": "npx", "env": { "ENVIA_API_KEY": "your_api_key_here" } } } } }, "letme": { "capability": "https://letme.dev/shipping.rates", "tool": "https://letme.dev/envia" }, "area": "business", "provenance": { "legalEntity": "", "domain": "envia.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://envia.com/en-US/legal/privacy-policy?n=privacy_policy", "statusPage": "", "changelog": "https://docs.envia.com/docs/changelog", "securityTxt": "unknown", "checked": "2026-11-06", "notes": [ "envia.com/robots.txt allows all but language-change paths; docs.envia.com disallows edit, login and api-next paths and links llms.txt.", "The privacy policy page renders only a heading without script, and every terms URL tried answered 500, so neither text was read.", "status.envia.com did not connect and no status page is linked. security.txt was not checked." ], "score": 32 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/envia.json", "live": { "slug": "envia", "versions": [ { "registry": "npm", "name": "@envia/envia-mcp", "version": "0.1.0", "seenAt": "2026-11-06T23:24:27.893485506Z" } ], "npmWeekly": 81, "securityTxt": { "url": "https://envia.com/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-11-07T16:01:23.154161694Z" }, "llmsTxt": { "url": "https://docs.envia.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:25.501362093Z" }, "pages": [ { "url": "https://docs.envia.com/docs/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:06:16.542743112Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b3c01b7da2e7" }, { "url": "https://envia.com/en-US/legal/privacy-policy?n=privacy_policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:09:20.480053366Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "52e5d34d2a62" } ], "updatedAt": "2026-11-07T16:01:23.154161694Z" } }, "answer": "Shippo scores 61.9 (C) on agent readiness against Envia's 36.5 (F), and leads in every scored category.", "b": { "slug": "shippo", "name": "Shippo", "vendor": "Shippo", "vendorUrl": "https://goshippo.com", "kind": "http-api", "category": "shipping", "summary": "Multi-carrier shipping API from Shippo. It quotes rates, buys labels, validates addresses, tracks parcels and creates return labels across the carriers it connects, through a REST API, official SDKs and a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/shippo", "markdownUrl": "https://www.anchorterminal.com/tools/shippo.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shippo.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shippo.json", "dns": "shippo.grade.anchorterminal.com", "repo": "https://github.com/goshippo/ai", "license": "Proprietary service under Shippo's terms of use. The SDKs and the goshippo/ai repository (skills and MCP bridge) are MIT", "transports": [ "http" ], "remoteUrl": "https://api.goshippo.com", "packages": [ { "registry": "npm", "name": "shippo" }, { "registry": "pypi", "name": "shippo" }, { "registry": "npm", "name": "@shippo/shippo-mcp" } ], "auth": "mixed", "authNotes": "Self-serve API key. A person signs up at apps.goshippo.com/join and creates live (shippo_live_) and test (shippo_test_) keys in the API portal, with no review. Calls send `Authorization: ShippoToken \u003ckey\u003e`. Keys are shown once, can be deleted and replaced, and have no scopes. The hosted MCP server at mcp.shippo.com uses per-user OAuth against the live account, with one scope (\"*\"). OAuth credentials for a platform acting for other Shippo accounts come from the sales team. Client-side apps can use a 12-hour JWT from POST /embedded/authz.", "pricing": "freemium", "pricingNotes": "API Starter has no monthly fee. The first 30 labels a month are free, then 7 cents a label, on top of postage. Calls not tied to a Shippo label are charged per unit (see the price table). API Premier is custom, with volume discounts, through sales. Test mode is free with a test key, so an agent can start without a contract, and billing details are needed for live labels (https://goshippo.com/pricing/api).", "priceSummary": "$0.07 / tx", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI spec or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": 4, "popularity": { "githubStars": 3, "npmWeekly": 73114, "pypiWeekly": 20036, "asOf": "2026-10-07" }, "docsUrl": "https://docs.goshippo.com", "llmsTxt": "https://docs.goshippo.com/llms.txt", "openapi": "https://docs.goshippo.com/spec/shippoapi/public-api.yaml", "registryName": "com.shippo/shippo-mcp", "capabilities": [ "shipping.rates", "shipping.labels", "shipping.tracking", "shipping.address-validation", "shipping.returns" ], "tags": [ "hosted", "freemium", "free-tier", "api-key", "oauth", "mcp", "openapi", "llms-txt", "python", "typescript", "java", "webhooks", "sandbox", "status-page" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 61.9, "grade": "C", "agentReady": false, "rank": 583, "ranked": true, "rankOf": 1510, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 77, "payments": 40, "reliability": 69, "schema": 83, "security": 42, "transparency": 58 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": 0, "verdict": "Per-label and per-call prices are public, test keys are self-serve, and the OpenAPI spec, llms.txt and Markdown docs are open to a fetch. Label purchase has no idempotency key, API keys carry no scopes, and the status page logged carrier-side incidents on most days from August to October 2026.", "bestFor": "An agent that quotes and buys parcel labels across USPS, UPS, FedEx and DHL Express for a small or mid-size shipper, with a free test mode and public unit prices.", "strengths": [ "Public prices per unit, 7 cents a label after 30 free a month, 1 cent a rate request and 2 cents a tracking request", "Test keys (shippo_test_) create free test labels and mock tracking, with data kept apart from live", "OpenAPI 3.1 spec with 71 operations, plus llms.txt and a Markdown copy of each docs page", "Hosted MCP server at mcp.shippo.com with four tools, reads and writes split so a client can require approval for writes", "Rate limits published per endpoint, with separate live and test figures", "Dated release notes gave a month's notice of the EU product identifier requirement of 1 November 2026, with warnings in responses before enforcement" ], "weaknesses": [ "No idempotency key on label purchase or other writes. Only the Reporting API accepts one", "API keys have no scopes or read-only mode, and the OAuth flow has one scope, \"*\"", "The hosted MCP server runs on the live account only, with no test mode", "Carrier-side incidents on the status page on most days from August to October 2026, many marked major or critical", "Terms of use and privacy notice load only with JavaScript, and no SLA or subprocessor list was found", "The Python SDK's latest stable tag is 3.9.0 from 26 November 2024. 5.0.0 has been in beta since 22 October 2026", "No security.txt, and the disclosure page named in Shippo's own security policy returns 404" ], "agentNotes": [ "Build and test with a shippo_test_ key. Test and live object IDs are separate, and the hosted MCP server has no test mode", "Send `Authorization: ShippoToken \u003ckey\u003e`, not Bearer, and pin `Shippo-API-Version: 2018-02-08`", "Before retrying a failed POST /transactions, list recent transactions. There is no idempotency key, and a second purchase is a second charge", "Pass `async: false` on shipments and transactions, or poll the object until its status leaves QUEUED", "Set `results` on list calls (under 200). Defaults vary by resource, and list calls are limited to 50 a minute on live keys" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.9 } ], "editorialScores": { "ergonomics": 64, "maintenance": 77, "payments": 40, "reliability": 69, "schema": 83, "security": 42, "transparency": 31 }, "provenanceScore": 85, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install shippo", "http": "curl https://api.goshippo.com/shipments/ \\\n -H \"Authorization: ShippoToken \u003cAPI_TOKEN\u003e\" \\\n -H \"Content-Type: application/json\" \\\n -d '{...}'", "claudeCode": "claude mcp add --transport http shippo https://mcp.shippo.com", "config": { "mcpServers": { "shippo": { "url": "https://mcp.shippo.com" } } } }, "letme": { "capability": "https://letme.dev/shipping.rates", "tool": "https://letme.dev/shippo" }, "area": "business", "unitPrices": [ { "item": "Label, API Starter, after 30 free a month, plus postage", "unit": "tx", "usd": 0.07 }, { "item": "Rate request not tied to a Shippo label", "unit": "call", "usd": 0.01 }, { "item": "Tracking request not tied to a Shippo label", "unit": "call", "usd": 0.02 }, { "item": "Delivery date estimate", "unit": "call", "usd": 0.03 }, { "item": "US address validation", "unit": "call", "usd": 0.02 }, { "item": "Non-US address validation", "unit": "call", "usd": 0.08 } ], "provenance": { "legalEntity": "Shippo", "domain": "goshippo.com", "domainRegistered": "2013-09-21", "endpointOnVendorDomain": true, "terms": "https://privacy.goshippo.com/policies?name=terms-of-use", "privacy": "https://privacy.goshippo.com/policies?name=privacy-notice", "statusPage": "https://status.goshippo.com", "changelog": "https://docs.goshippo.com/api-concepts/api-change-log", "securityTxt": "none", "checked": "2026-11-02", "notes": [ "The registered legal entity wasn't confirmed. goshippo.com/terms and /privacy redirect to a privacy centre that returns no policy text without JavaScript. The SDK licences name \"Shippo\" as copyright holder.", "RDAP for goshippo.com gives a registration date of 2013-09-21.", "The API answers at api.goshippo.com and the MCP server at mcp.shippo.com, whose OAuth metadata names https://goshippo.com as the authorisation server.", "goshippo.com/.well-known/security.txt and goshippo.com/security both return 404. The AI repository's SECURITY.md gives security@goshippo.com.", "trust.goshippo.com answers robots.txt with 403 AccessDenied and privacy.goshippo.com with its app page, so neither was read on 2 November 2026." ], "score": 85 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shippo.json", "live": { "slug": "shippo", "probe": { "target": "https://api.goshippo.com", "method": "get", "lastAt": "2026-11-07T19:22:32.72244701Z", "lastOk": true, "lastStatus": 401, "lastMs": 145, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 137, "p95ms24h": 391, "samples24h": 238, "samples30d": 7473, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 197, "ok": 197 } ] }, "vendorStatus": { "page": "https://status.goshippo.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T19:23:42.316759844Z" }, "versions": [ { "registry": "github", "name": "goshippo/ai", "version": "v1.5.4", "released": "2026-07-23", "seenAt": "2026-11-07T00:05:13.725507204Z" }, { "registry": "mcp-registry", "name": "com.shippo/shippo-mcp", "version": "1.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@shippo/shippo-mcp", "version": "3.0.4", "seenAt": "2026-11-07T00:05:12.570847669Z" }, { "registry": "npm", "name": "shippo", "version": "2.19.1", "seenAt": "2026-11-07T00:05:11.499604983Z" }, { "registry": "pypi", "name": "shippo", "version": "3.9.0", "released": "2024-11-26", "seenAt": "2026-11-07T00:05:12.355449434Z" } ], "githubStars": 3, "npmWeekly": 78382, "pypiWeekly": 22556, "securityTxt": { "url": "https://goshippo.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:05.451750051Z" }, "llmsTxt": { "url": "https://docs.goshippo.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:54.763692987Z" }, "domain": { "domain": "goshippo.com", "registered": "2013-09-21", "source": "https://rdap.verisign.com/com/v1/domain/goshippo.com", "checkedAt": "2026-11-01T14:23:37.391892924Z" }, "pages": [ { "url": "https://docs.goshippo.com/api-concepts/api-change-log", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:06:28.025111681Z", "changedAt": "2026-11-05T12:30:25.846068563Z", "fingerprint": "b3b2a73d88b1" }, { "url": "https://goshippo.com/pricing/api", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:10:33.463721097Z", "changedAt": "2026-11-03T07:50:52.570035252Z", "fingerprint": "63a2e0a9d7e4" }, { "url": "https://privacy.goshippo.com/policies?name=privacy-notice", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:17:23.915284521Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3b0c44298fc" }, { "url": "https://privacy.goshippo.com/policies?name=terms-of-use", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:17:26.364765063Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3b0c44298fc" } ], "mcpTools": { "url": "https://mcp.shippo.com", "checkedAt": "2026-11-07T01:47:54.524178346Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:47:54.524178346Z" }, "github": { "repo": "goshippo/ai", "checkedAt": "2026-11-02T08:52:34.500876974Z", "stars": 3, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-09T14:55:41Z", "openIssues": 0, "openPRs": 7, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "main", "runs": 48, "success": 46, "failure": 1, "other": 1, "latest": "success", "latestAt": "2026-07-24T02:06:16Z" } }, "updatedAt": "2026-11-07T19:23:42.316759844Z" } }, "edges": [ { "by": 67, "category": "maintenance", "leads": "shippo", "name": "Maintenance \u0026 community", "reasons": { "a": "The latest dated change found is the docs changelog for March 2026 and @envia/envia-mcp 0.1.0 on 4 March 2026, more than 180 days ago; doc pages show later `updatedAt` stamps (28 October for the FAQ) that record no change (0). No dated entries in the 90 days from 8 August (0). Support through the dashboard and docs, with no public tracker; the MCP repository named on npm could not be cloned (5 of 15). The MCP package is official, with no API SDK and no registry entry (5 of 15). No public CI to read (0). 0 + 0 + 5 + 5 + 0 = 10.", "b": "The API release notes were last updated on 20 October 2026, and the `shippo` npm SDK 2.19.1 was tagged on 27 October 2026 (30). Six dated entries from 4 August, the latest on 1, 8, 14 and 20 October, plus TypeScript SDK 2.19.0 and 2.19.1 (20). Closed service with dated release notes and a support portal. Open issue counts weren't re-read (9 of 15). The MCP server is in the official registry as com.shippo/shippo-mcp, verified by DNS. Official SDKs exist in five languages. The TypeScript SDK was regenerated in October, while the Python SDK's latest stable tag is 3.9.0 from 26 November 2024, with 5.0.0 in beta since 22 October 2026 (12 of 15). SDKs are generated and validated by CI workflows, and goshippo/ai has test and validation workflows, last tagged 23 July (6 of 10)." }, "scores": { "a": 10, "b": 77 } }, { "by": 49, "category": "reliability", "leads": "shippo", "name": "Reliability", "reasons": { "a": "Graded as a hosted service on Envia's REST APIs, with the local MCP server noted. No status page is linked and status.envia.com did not connect (0). No readable incident history (5). No rate limits found in the docs index, FAQs, integration guide or production checklist (0). The production checklist asks for 5xx retry logic and webhook deduplication, with no 429 or idempotency guidance for label creation (5 of 15). No SLA found (0). Neither the APIs nor the MCP server is labelled beta (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.", "b": "Read with the hosted lines and scored on the REST API at api.goshippo.com. Statuspage at status.goshippo.com with components for the REST API, the dashboard and each carrier (20). From 4 August to 2 November 2026 the history holds 101 incidents outside maintenance. All but three are on a single carrier's rating, label or tracking service. The others are degraded billing performance on 12 and 13 August, a dashboard error on 9 and 10 September and labels missing from the web app's shipments tab on 17 and 18 September. None names the Shippo REST API. The longest, 25 August (05:18 to 14:27 UTC, marked major), affected one carrier API (Pitney Bowes). This run reads incidents that hit one carrier or part of the service as partial, whatever their label, so minor only (20 of 30). Per-minute limits per endpoint, live and test (15). The docs say a 429 is returned and nothing more. No Retry-After or backoff guidance was found, and label purchase takes no idempotency key, though the TypeScript SDK has a configurable backoff retry (4 of 15). No SLA found. API Premier lists paid 24/7 monitoring as an add-on (0). GA (10)." }, "scores": { "a": 20, "b": 69 } }, { "by": 42, "category": "transparency", "leads": "shippo", "name": "Transparency \u0026 trust", "reasons": { "a": "Every terms URL tried answered 500 and the privacy policy is drawn by script, so no terms, entity or data-handling statement was read (0 of 30, 0 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations found (0). 0 + 0 + 0 + 0 = 0, as unread rather than absent where the pages exist.", "b": "Closed service. The terms of use sit in a privacy centre that loads only with JavaScript, so we couldn't read them or confirm the contracting entity. SDKs and the goshippo/ai repository are MIT (12 of 30). The privacy notice has the same problem. The release notes say shipments and rates are retrievable for 390 days. The trust centre's DPA link and encryption statements, read on 7 October, are set aside because the host now refuses our crawler, and no retention periods were read (4 of 30). The versioning page says accounts are never forced onto a new API version, and notices carry dates, such as the 1 and 14 October 2026 notices of the EU product identifier requirement from 1 November. Carrier removals are announced on the day (12 of 20). Webhook addresses are published for US and EU regions. The trust centre's hosting and third-party statements are set aside, and no subprocessor list was found (3 of 20)." }, "scores": { "a": 16, "b": 58 } }, { "by": 20, "category": "payments", "leads": "shippo", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). No public price list: each cost is shown when quoting, and volume plans go through sales (0). A free sandbox account creates test labels with no charges (20). A person signs up in a browser and tops up a balance for live labels (0). 0 + 0 + 20 + 0 = 20.", "b": "No x402, MPP or L402 (0). Per-unit prices are public without a login. API Starter is 7 cents a label after 30 free a month, 1 cent a rate request, 2 cents a tracking request, 2 cents a US address validation and 8 cents elsewhere, plus the postage itself (20). Signup is free, and test keys create test labels and mock tracking at no charge. The docs say billing details are needed only for live label purchase. We didn't open an account to confirm (20). A person signs up in a browser and creates the key in the portal, or signs in through OAuth for the MCP server (0)." }, "scores": { "a": 20, "b": 40 } }, { "by": 11, "category": "ergonomics", "leads": "shippo", "name": "Agent ergonomics", "reasons": { "a": "Ten compact MCP tools (25). Rates take one carrier per request, and the Queries API filters carriers by country and shipment type; no paging or field selection was found (10 of 20). The FAQ maps common errors to fixes, but the changelog says the three APIs return different error formats that need a normalisation helper (10 of 20). No idempotency key for labels; an unscanned label can be cancelled for an automatic refund, and the MCP tools carry no annotations (3 of 20). The MCP server defaults to sandbox, with no official API SDK (5 of 15). 25 + 10 + 10 + 3 + 5 = 53.", "b": "Scored on the REST API, with the MCP server noted. List calls take `results` and `page`, and `expand` controls nested objects, but there's no field selection and a shipment returns every rate. The MCP server has four tools (list, describe, read-execute, write-execute) over 73 operations, which keeps definitions small (17 of 25). Pagination on every list. Date filters exist only on shipments, within a 90-day range (14 of 20). Status codes are documented in general terms and the error body is untyped. The goshippo/ai repository has an error reference with recovery steps for MCP use (12 of 20). No idempotency key on shipments, transactions or refunds. The Reporting API accepts `idempotency_key`. The MCP read and write split lets a client approve writes. Its annotations sit behind sign-in and weren't read (8 of 20). Official SDKs for Python, TypeScript, Java, C# and PHP. Shipments and transactions default to asynchronous, and objects can't be edited after creation (13 of 15)." }, "scores": { "a": 53, "b": 64 } }, { "by": 7, "category": "security", "leads": "shippo", "name": "Security \u0026 auth", "reasons": { "a": "Bearer tokens bound to one environment, several per account, revocable by deleting them, with no scopes (20). No read-only token; the MCP server's sandbox default keeps test calls from spending money (5 of 20). Responses carry carrier and address data rather than free text from strangers (10). No audit log found (0). No security page, certification, security.txt or disclosure policy found (0). 20 + 5 + 10 + 0 + 0 = 35.", "b": "Self-serve API keys, live and test kept apart, shown once, deletable in the portal, with no scopes and no documented expiry. The OAuth flow for platforms has one scope, \"*\". JWTs for client-side use last 12 hours (20 of 30). A webhook can carry a self-made token in its URL query string. That is the receiver's secret, not the API credential, so we noted it without the deduction. No read-only key. Test keys can't spend money, and the MCP server separates reads from writes and its docs say writes ask for confirmation (9 of 20). Tracking events, metadata and address text come from carriers and other parties. The AI repository's security policy puts prompt injection in scope for reports, with no guidance in the API docs (5 of 15). The API portal is described as showing usage. No audit log was found in the docs (3 of 15). The AI repository's security policy gives security@goshippo.com and names goshippo.com/security as the disclosure page, which returns 404, as does security.txt. The trust centre at trust.goshippo.com, where the 7 October check read SOC 2 Type II, PCI DSS, a penetration test and a bug bounty, now refuses our crawler, so those readings are set aside and unscored (5 of 20)." }, "scores": { "a": 35, "b": 42 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Envia Shipping", "b": "Shippo", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.goshippo.com", "name": "Hosted endpoint" }, { "a": "stdio", "b": "HTTP", "name": "Transports" }, { "a": "API key", "b": "OAuth or key", "name": "Auth" }, { "a": "Pay per use", "b": "Freemium", "name": "Pricing" }, { "a": "not published", "b": "$0.01 per call", "name": "Price for shipping rates" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Proprietary service under Shippo's terms of use. The SDKs and the goshippo/ai repository (skills and MCP bridge) are MIT", "name": "Licence" }, { "a": "10", "b": "4", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "com.shippo/shippo-mcp", "name": "MCP registry" }, { "a": "2026-03-06", "b": "2026-10-27", "name": "Last release" }, { "a": "no document linked", "b": "couldn't be read", "name": "Terms last updated" }, { "a": "no date given", "b": "couldn't be read", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "couldn't be read", "name": "Customer content may train models" }, { "a": "not read yet", "b": "couldn't be read", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "couldn't be read", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "couldn't be read", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "couldn't be read", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "3 stars, 73k npm/wk, 20k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Shippo scores 61.9 (C) on agent readiness against Envia's 36.5 (F), and leads in every scored category.", "question": "Which is better for AI agents, Envia or Shippo?" }, { "answer": "Envia needs an API key. Shippo takes an API key or an OAuth sign-in.", "question": "Do Envia and Shippo need an API key?" }, { "answer": "Envia runs on your own machine, with no hosted endpoint listed. Shippo has a hosted endpoint at https://api.goshippo.com.", "question": "Can an agent call Envia and Shippo without installing anything?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Runs on your own machine" ], "goodFor": "Shops and platforms shipping in Mexico and Latin America that want rates and labels from many local carriers.", "slug": "envia", "watchFor": "No status page or rate limits found" }, { "aheadOn": [ "Reliability, 69 against 20", "Agent ergonomics, 64 against 53", "Security \u0026 auth, 42 against 35", "Payments \u0026 pricing, 40 against 20", "Maintenance \u0026 community, 77 against 10", "Transparency \u0026 trust, 58 against 16" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "An agent that quotes and buys parcel labels across USPS, UPS, FedEx and DHL Express for a small or mid-size shipper, with a free test mode and public unit prices.", "slug": "shippo", "watchFor": "No idempotency key on label purchase or other writes. Only the Reporting API accepts one" } ], "history": { "envia": null, "shippo": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-02", "delta": -0.1, "from": 62, "fromGrade": "B", "to": 61.9, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-28", "delta": 0.1, "from": 61.9, "fromGrade": "C", "to": 62, "toGrade": "B" } ] }, "job": { "capability": "shipping.rates", "name": "Shipping rates" }, "others": [ { "json": "https://www.anchorterminal.com/compare/atoship-vs-envia.json", "title": "atoship vs Envia", "url": "https://www.anchorterminal.com/compare/atoship-vs-envia" }, { "json": "https://www.anchorterminal.com/compare/atoship-vs-shippo.json", "title": "atoship vs Shippo", "url": "https://www.anchorterminal.com/compare/atoship-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/easypost-vs-envia.json", "title": "EasyPost vs Envia", "url": "https://www.anchorterminal.com/compare/easypost-vs-envia" }, { "json": "https://www.anchorterminal.com/compare/easypost-vs-shippo.json", "title": "EasyPost vs Shippo", "url": "https://www.anchorterminal.com/compare/easypost-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/easyship-vs-envia.json", "title": "Easyship vs Envia", "url": "https://www.anchorterminal.com/compare/easyship-vs-envia" }, { "json": "https://www.anchorterminal.com/compare/easyship-vs-shippo.json", "title": "Easyship vs Shippo", "url": "https://www.anchorterminal.com/compare/easyship-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/envia-vs-karrio.json", "title": "Envia vs Karrio", "url": "https://www.anchorterminal.com/compare/envia-vs-karrio" }, { "json": "https://www.anchorterminal.com/compare/envia-vs-sendcloud.json", "title": "Envia vs Sendcloud", "url": "https://www.anchorterminal.com/compare/envia-vs-sendcloud" }, { "json": "https://www.anchorterminal.com/compare/envia-vs-shipbob.json", "title": "Envia vs ShipBob", "url": "https://www.anchorterminal.com/compare/envia-vs-shipbob" }, { "json": "https://www.anchorterminal.com/compare/envia-vs-shippypro.json", "title": "Envia vs ShippyPro", "url": "https://www.anchorterminal.com/compare/envia-vs-shippypro" }, { "json": "https://www.anchorterminal.com/compare/envia-vs-shipstation.json", "title": "Envia vs ShipStation API", "url": "https://www.anchorterminal.com/compare/envia-vs-shipstation" }, { "json": "https://www.anchorterminal.com/compare/karrio-vs-shippo.json", "title": "Karrio vs Shippo", "url": "https://www.anchorterminal.com/compare/karrio-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/sendcloud-vs-shippo.json", "title": "Sendcloud vs Shippo", "url": "https://www.anchorterminal.com/compare/sendcloud-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/shipbob-vs-shippo.json", "title": "ShipBob vs Shippo", "url": "https://www.anchorterminal.com/compare/shipbob-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/shippo-vs-shippypro.json", "title": "Shippo vs ShippyPro", "url": "https://www.anchorterminal.com/compare/shippo-vs-shippypro" }, { "json": "https://www.anchorterminal.com/compare/shippo-vs-shipstation.json", "title": "Shippo vs ShipStation API", "url": "https://www.anchorterminal.com/compare/shippo-vs-shipstation" }, { "json": "https://www.anchorterminal.com/compare/envia-vs-ship24.json", "title": "Envia vs Ship24", "url": "https://www.anchorterminal.com/compare/envia-vs-ship24" }, { "json": "https://www.anchorterminal.com/compare/envia-vs-trackingmore.json", "title": "Envia vs TrackingMore", "url": "https://www.anchorterminal.com/compare/envia-vs-trackingmore" }, { "json": "https://www.anchorterminal.com/compare/ship24-vs-shippo.json", "title": "Ship24 vs Shippo", "url": "https://www.anchorterminal.com/compare/ship24-vs-shippo" }, { "json": "https://www.anchorterminal.com/compare/shippo-vs-trackingmore.json", "title": "Shippo vs TrackingMore", "url": "https://www.anchorterminal.com/compare/shippo-vs-trackingmore" } ], "panel": null, "scores": [ { "by": 49, "edge": "shippo", "envia": 20, "key": "reliability", "name": "Reliability", "shippo": 69, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 3, "edge": "shippo", "envia": 80, "key": "schema", "name": "Schema \u0026 documentation", "shippo": 83, "weight": 13 }, { "by": 11, "edge": "shippo", "envia": 53, "key": "ergonomics", "name": "Agent ergonomics", "shippo": 64, "weight": 13 }, { "by": 7, "edge": "shippo", "envia": 35, "key": "security", "name": "Security \u0026 auth", "shippo": 42, "weight": 14 }, { "by": 20, "edge": "shippo", "envia": 20, "key": "payments", "name": "Payments \u0026 pricing", "shippo": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 67, "edge": "shippo", "envia": 10, "key": "maintenance", "name": "Maintenance \u0026 community", "shippo": 77, "weight": 7 }, { "by": 42, "edge": "shippo", "envia": 16, "key": "transparency", "name": "Transparency \u0026 trust", "shippo": 58, "weight": 7 } ], "summary": "Shippo scores 61.9 (C) on agent readiness against Envia's 36.5 (F), and leads in every scored category. Both do shipping rates.", "tasks": null, "tutorials": [], "verdicts": { "envia": "Envia's shipping APIs are documented for agents, with llms.txt, OpenAPI definitions on every reference page, a free sandbox and a compact ten-tool MCP server that defaults to test mode. No status page, rate limits, public price list or readable terms were found, and the MCP package has had one release.", "shippo": "Per-label and per-call prices are public, test keys are self-serve, and the OpenAPI spec, llms.txt and Markdown docs are open to a fetch. Label purchase has no idempotency key, API keys carry no scopes, and the status page logged carrier-side incidents on most days from August to October 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/envia-vs-shippo", "json": "https://www.anchorterminal.com/compare/envia-vs-shippo.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/envia-vs-shippo.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/envia-vs-shippo.min.md" }, "markdown": "Shippo scores 61.9 (C) on agent readiness against Envia's 36.5 (F), and leads in every scored category. Both do shipping rates.\n\n- Envia: grade F, 36.5/100, rank #1384 of 1510. Markdown https://www.anchorterminal.com/tools/envia.md · JSON https://www.anchorterminal.com/api/v1/tools/envia.json\n- Shippo: grade C, 61.9/100, rank #583 of 1510. Markdown https://www.anchorterminal.com/tools/shippo.md · JSON https://www.anchorterminal.com/api/v1/tools/shippo.json\n- Best shipping and fulfilment APIs for AI agents: https://www.anchorterminal.com/best/shipping/index.md\n- All 66 shipping comparisons: https://www.anchorterminal.com/compare/shipping/index.md\n\n## Which one, for what\n\n### Envia (F)\n\nGood for: Shops and platforms shipping in Mexico and Latin America that want rates and labels from many local carriers.\n\nAlso in its favour:\n- Runs on your own machine\n\nWatch for: No status page or rate limits found\n\n### Shippo (C)\n\nGood for: An agent that quotes and buys parcel labels across USPS, UPS, FedEx and DHL Express for a small or mid-size shipper, with a free test mode and public unit prices.\n\nAhead on:\n- Reliability, 69 against 20\n- Agent ergonomics, 64 against 53\n- Security \u0026 auth, 42 against 35\n- Payments \u0026 pricing, 40 against 20\n- Maintenance \u0026 community, 77 against 10\n- Transparency \u0026 trust, 58 against 16\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: No idempotency key on label purchase or other writes. Only the Reporting API accepts one\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Shippo +67\n\n- Envia (10): The latest dated change found is the docs changelog for March 2026 and @envia/envia-mcp 0.1.0 on 4 March 2026, more than 180 days ago; doc pages show later `updatedAt` stamps (28 October for the FAQ) that record no change (0). No dated entries in the 90 days from 8 August (0). Support through the dashboard and docs, with no public tracker; the MCP repository named on npm could not be cloned (5 of 15). The MCP package is official, with no API SDK and no registry entry (5 of 15). No public CI to read (0). 0 + 0 + 5 + 5 + 0 = 10.\n- Shippo (77): The API release notes were last updated on 20 October 2026, and the `shippo` npm SDK 2.19.1 was tagged on 27 October 2026 (30). Six dated entries from 4 August, the latest on 1, 8, 14 and 20 October, plus TypeScript SDK 2.19.0 and 2.19.1 (20). Closed service with dated release notes and a support portal. Open issue counts weren't re-read (9 of 15). The MCP server is in the official registry as com.shippo/shippo-mcp, verified by DNS. Official SDKs exist in five languages. The TypeScript SDK was regenerated in October, while the Python SDK's latest stable tag is 3.9.0 from 26 November 2024, with 5.0.0 in beta since 22 October 2026 (12 of 15). SDKs are generated and validated by CI workflows, and goshippo/ai has test and validation workflows, last tagged 23 July (6 of 10).\n\n### Reliability: Shippo +49\n\n- Envia (20): Graded as a hosted service on Envia's REST APIs, with the local MCP server noted. No status page is linked and status.envia.com did not connect (0). No readable incident history (5). No rate limits found in the docs index, FAQs, integration guide or production checklist (0). The production checklist asks for 5xx retry logic and webhook deduplication, with no 429 or idempotency guidance for label creation (5 of 15). No SLA found (0). Neither the APIs nor the MCP server is labelled beta (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.\n- Shippo (69): Read with the hosted lines and scored on the REST API at api.goshippo.com. Statuspage at status.goshippo.com with components for the REST API, the dashboard and each carrier (20). From 4 August to 2 November 2026 the history holds 101 incidents outside maintenance. All but three are on a single carrier's rating, label or tracking service. The others are degraded billing performance on 12 and 13 August, a dashboard error on 9 and 10 September and labels missing from the web app's shipments tab on 17 and 18 September. None names the Shippo REST API. The longest, 25 August (05:18 to 14:27 UTC, marked major), affected one carrier API (Pitney Bowes). This run reads incidents that hit one carrier or part of the service as partial, whatever their label, so minor only (20 of 30). Per-minute limits per endpoint, live and test (15). The docs say a 429 is returned and nothing more. No Retry-After or backoff guidance was found, and label purchase takes no idempotency key, though the TypeScript SDK has a configurable backoff retry (4 of 15). No SLA found. API Premier lists paid 24/7 monitoring as an add-on (0). GA (10).\n\n### Transparency \u0026 trust: Shippo +42\n\n- Envia (16): Every terms URL tried answered 500 and the privacy policy is drawn by script, so no terms, entity or data-handling statement was read (0 of 30, 0 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations found (0). 0 + 0 + 0 + 0 = 0, as unread rather than absent where the pages exist.\n- Shippo (58): Closed service. The terms of use sit in a privacy centre that loads only with JavaScript, so we couldn't read them or confirm the contracting entity. SDKs and the goshippo/ai repository are MIT (12 of 30). The privacy notice has the same problem. The release notes say shipments and rates are retrievable for 390 days. The trust centre's DPA link and encryption statements, read on 7 October, are set aside because the host now refuses our crawler, and no retention periods were read (4 of 30). The versioning page says accounts are never forced onto a new API version, and notices carry dates, such as the 1 and 14 October 2026 notices of the EU product identifier requirement from 1 November. Carrier removals are announced on the day (12 of 20). Webhook addresses are published for US and EU regions. The trust centre's hosting and third-party statements are set aside, and no subprocessor list was found (3 of 20).\n\n### Payments \u0026 pricing: Shippo +20\n\n- Envia (20): No x402, MPP or L402 (0). No public price list: each cost is shown when quoting, and volume plans go through sales (0). A free sandbox account creates test labels with no charges (20). A person signs up in a browser and tops up a balance for live labels (0). 0 + 0 + 20 + 0 = 20.\n- Shippo (40): No x402, MPP or L402 (0). Per-unit prices are public without a login. API Starter is 7 cents a label after 30 free a month, 1 cent a rate request, 2 cents a tracking request, 2 cents a US address validation and 8 cents elsewhere, plus the postage itself (20). Signup is free, and test keys create test labels and mock tracking at no charge. The docs say billing details are needed only for live label purchase. We didn't open an account to confirm (20). A person signs up in a browser and creates the key in the portal, or signs in through OAuth for the MCP server (0).\n\n### Agent ergonomics: Shippo +11\n\n- Envia (53): Ten compact MCP tools (25). Rates take one carrier per request, and the Queries API filters carriers by country and shipment type; no paging or field selection was found (10 of 20). The FAQ maps common errors to fixes, but the changelog says the three APIs return different error formats that need a normalisation helper (10 of 20). No idempotency key for labels; an unscanned label can be cancelled for an automatic refund, and the MCP tools carry no annotations (3 of 20). The MCP server defaults to sandbox, with no official API SDK (5 of 15). 25 + 10 + 10 + 3 + 5 = 53.\n- Shippo (64): Scored on the REST API, with the MCP server noted. List calls take `results` and `page`, and `expand` controls nested objects, but there's no field selection and a shipment returns every rate. The MCP server has four tools (list, describe, read-execute, write-execute) over 73 operations, which keeps definitions small (17 of 25). Pagination on every list. Date filters exist only on shipments, within a 90-day range (14 of 20). Status codes are documented in general terms and the error body is untyped. The goshippo/ai repository has an error reference with recovery steps for MCP use (12 of 20). No idempotency key on shipments, transactions or refunds. The Reporting API accepts `idempotency_key`. The MCP read and write split lets a client approve writes. Its annotations sit behind sign-in and weren't read (8 of 20). Official SDKs for Python, TypeScript, Java, C# and PHP. Shipments and transactions default to asynchronous, and objects can't be edited after creation (13 of 15).\n\n### Security \u0026 auth: Shippo +7\n\n- Envia (35): Bearer tokens bound to one environment, several per account, revocable by deleting them, with no scopes (20). No read-only token; the MCP server's sandbox default keeps test calls from spending money (5 of 20). Responses carry carrier and address data rather than free text from strangers (10). No audit log found (0). No security page, certification, security.txt or disclosure policy found (0). 20 + 5 + 10 + 0 + 0 = 35.\n- Shippo (42): Self-serve API keys, live and test kept apart, shown once, deletable in the portal, with no scopes and no documented expiry. The OAuth flow for platforms has one scope, \"*\". JWTs for client-side use last 12 hours (20 of 30). A webhook can carry a self-made token in its URL query string. That is the receiver's secret, not the API credential, so we noted it without the deduction. No read-only key. Test keys can't spend money, and the MCP server separates reads from writes and its docs say writes ask for confirmation (9 of 20). Tracking events, metadata and address text come from carriers and other parties. The AI repository's security policy puts prompt injection in scope for reports, with no guidance in the API docs (5 of 15). The API portal is described as showing usage. No audit log was found in the docs (3 of 15). The AI repository's security policy gives security@goshippo.com and names goshippo.com/security as the disclosure page, which returns 404, as does security.txt. The trust centre at trust.goshippo.com, where the 7 October check read SOC 2 Type II, PCI DSS, a penetration test and a bug bounty, now refuses our crawler, so those readings are set aside and unscored (5 of 20).\n\n## Score by category\n\n| Category | Weight | Envia | Shippo | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 20 | 69 | Shippo +49 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 80 | 83 | Shippo +3 |\n| Agent ergonomics | 13% (16.2 this run) | 53 | 64 | Shippo +11 |\n| Security \u0026 auth | 14% (17.5 this run) | 35 | 42 | Shippo +7 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 40 | Shippo +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 10 | 77 | Shippo +67 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 16 | 58 | Shippo +42 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **36.5 · F** | **61.9 · C** | |\n\n## Facts side by side\n\n| Fact | Envia | Shippo |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Envia Shipping | Shippo |\n| Hosted endpoint | no (local only) | `https://api.goshippo.com` |\n| Transports | stdio | HTTP |\n| Auth | API key | OAuth or key |\n| Pricing | Pay per use | Freemium |\n| Price for shipping rates | not published | $0.01 per call |\n| x402 | no | no |\n| Licence | none | Proprietary service under Shippo's terms of use. The SDKs and the goshippo/ai repository (skills and MCP bridge) are MIT |\n| Tools exposed | 10 | 4 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | `com.shippo/shippo-mcp` |\n| Last release | 2026-03-06 | 2026-10-27 |\n| Terms last updated | no document linked | couldn't be read |\n| Privacy policy last updated | no date given | couldn't be read |\n| Customer content may train models | not read yet | couldn't be read |\n| Terms restrict automated access | not read yet | couldn't be read |\n| Terms restrict benchmarking | not read yet | couldn't be read |\n| Terms or service can change without notice | not read yet | couldn't be read |\n| Arbitration or class-action waiver | not read yet | couldn't be read |\n| Popularity | none | 3 stars, 73k npm/wk, 20k PyPI/wk |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### Envia\n\nNo score change since it was listed.\n\n### Shippo\n\n- -0.1 on 2 November 2026 (B to C): new evidence, correction\n- +0.1 on 28 October 2026 (C to B): checklist\n\n## Verdicts\n\n**Envia.** Envia's shipping APIs are documented for agents, with llms.txt, OpenAPI definitions on every reference page, a free sandbox and a compact ten-tool MCP server that defaults to test mode. No status page, rate limits, public price list or readable terms were found, and the MCP package has had one release.\n\n**Shippo.** Per-label and per-call prices are public, test keys are self-serve, and the OpenAPI spec, llms.txt and Markdown docs are open to a fetch. Label purchase has no idempotency key, API keys carry no scopes, and the status page logged carrier-side incidents on most days from August to October 2026.\n\n## Before you call either\n\n### Envia\n\n1. Leave `ENVIA_ENVIRONMENT` unset until the user confirms live shipping; the default is sandbox\n2. Ask the user before `envia_create_label` in production, since it spends the account balance\n3. Validate the postal code at geocodes.envia.com before quoting to avoid no-coverage errors\n4. Cancel an unwanted label before the carrier scans it to get the automatic refund\n5. Use a sandbox token with sandbox hosts and a production token with production hosts; they are not interchangeable\n\n### Shippo\n\n1. Build and test with a shippo_test_ key. Test and live object IDs are separate, and the hosted MCP server has no test mode\n2. Send `Authorization: ShippoToken \u003ckey\u003e`, not Bearer, and pin `Shippo-API-Version: 2018-02-08`\n3. Before retrying a failed POST /transactions, list recent transactions. There is no idempotency key, and a second purchase is a second charge\n4. Pass `async: false` on shipments and transactions, or poll the object until its status leaves QUEUED\n5. Set `results` on list calls (under 200). Defaults vary by resource, and list calls are limited to 50 a minute on live keys\n\n## Questions\n\n### Which is better for AI agents, Envia or Shippo?\n\nShippo scores 61.9 (C) on agent readiness against Envia's 36.5 (F), and leads in every scored category.\n\n### Do Envia and Shippo need an API key?\n\nEnvia needs an API key. Shippo takes an API key or an OAuth sign-in.\n\n### Can an agent call Envia and Shippo without installing anything?\n\nEnvia runs on your own machine, with no hosted endpoint listed. Shippo has a hosted endpoint at https://api.goshippo.com.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/envia-vs-shippo.json, and with the fewest tokens: https://www.anchorterminal.com/compare/envia-vs-shippo.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"envia\", \"b\": \"shippo\"}`. From a terminal: `anchor compare envia shippo`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/envia.json and https://www.anchorterminal.com/api/v1/tools/shippo.json\n\n## Other comparisons with Envia or Shippo\n\n- [atoship vs Envia](https://www.anchorterminal.com/compare/atoship-vs-envia.md)\n- [atoship vs Shippo](https://www.anchorterminal.com/compare/atoship-vs-shippo.md)\n- [EasyPost vs Envia](https://www.anchorterminal.com/compare/easypost-vs-envia.md)\n- [EasyPost vs Shippo](https://www.anchorterminal.com/compare/easypost-vs-shippo.md)\n- [Easyship vs Envia](https://www.anchorterminal.com/compare/easyship-vs-envia.md)\n- [Easyship vs Shippo](https://www.anchorterminal.com/compare/easyship-vs-shippo.md)\n- [Envia vs Karrio](https://www.anchorterminal.com/compare/envia-vs-karrio.md)\n- [Envia vs Sendcloud](https://www.anchorterminal.com/compare/envia-vs-sendcloud.md)\n- [Envia vs ShipBob](https://www.anchorterminal.com/compare/envia-vs-shipbob.md)\n- [Envia vs ShippyPro](https://www.anchorterminal.com/compare/envia-vs-shippypro.md)\n- [Envia vs ShipStation API](https://www.anchorterminal.com/compare/envia-vs-shipstation.md)\n- [Karrio vs Shippo](https://www.anchorterminal.com/compare/karrio-vs-shippo.md)\n- [Sendcloud vs Shippo](https://www.anchorterminal.com/compare/sendcloud-vs-shippo.md)\n- [ShipBob vs Shippo](https://www.anchorterminal.com/compare/shipbob-vs-shippo.md)\n- [Shippo vs ShippyPro](https://www.anchorterminal.com/compare/shippo-vs-shippypro.md)\n- [Shippo vs ShipStation API](https://www.anchorterminal.com/compare/shippo-vs-shipstation.md)\n- [Envia vs Ship24](https://www.anchorterminal.com/compare/envia-vs-ship24.md)\n- [Envia vs TrackingMore](https://www.anchorterminal.com/compare/envia-vs-trackingmore.md)\n- [Ship24 vs Shippo](https://www.anchorterminal.com/compare/ship24-vs-shippo.md)\n- [Shippo vs TrackingMore](https://www.anchorterminal.com/compare/shippo-vs-trackingmore.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Envia vs Shippo", "url": "" } ], "description": "Shippo scores 61.9 (C) to Envia's 36.5 (F) for shipping rates. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Envia F 36.5", "Shippo C 61.9", "scores" ], "h1": "Envia vs Shippo", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/envia-vs-shippo", "published": "2026-10-01", "section": "tools", "title": "Envia vs Shippo for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/envia-vs-shippo" }, "tokens": { "markdown": 4400, "slim": 2880 }, "version": 1 }